IPSEC fragmentation

2 replies
1264 views

Hello, I understand that even if a a Telco Internet circuit supports a standard MTU of 1500 and fragmentation is either not supported or reliable, that this is irrelevant to the fragmentation that may take place on traffic passing via a Fortigate IPSEC tunnel across that Internet circuit i.e. the two concepts are separate.

So, you could have a telco Internet circuit with 1500 MTU and no fragmentation support, but fragmentation can still work WITHIN the Fortigate established IPSEC tunnel.

Am I correct in this thinking ?

Thank you kindly.

Dhruvin_patelAnswer

Staff

Greetings!

Yes, the MTU and fragmentation settings on a Telco internet circuit are separate from the fragmentation that may occur within a FortiGate IPSec tunnel. Even if the Telco internet circuit has an MTU of 1500 with no fragmentation support, fragmentation can still occur within the FortiGate IPSec tunnel. The FortiGate can handle fragmentation independently within the tunnel to ensure proper transmission of packets across the network, regardless of the MTU settings of the external internet circuit.

Regards!

Dhruvin_patelAnswer

Staff

Greetings!

Yes, the MTU and fragmentation settings on a Telco internet circuit are separate from the fragmentation that may occur within a FortiGate IPSec tunnel. Even if the Telco internet circuit has an MTU of 1500 with no fragmentation support, fragmentation can still occur within the FortiGate IPSec tunnel. The FortiGate can handle fragmentation independently within the tunnel to ensure proper transmission of packets across the network, regardless of the MTU settings of the external internet circuit.

Regards!

Toshi_Esumi

SuperUser

Get in CLI to check the calculated MTU on the IPsec virtual interface like below:
FortiGate-70F # diag netlink interface list | grep -f atl-vpn
if=atl-vpn family=00 type=768 index=27 mtu=1420 link=0 master=0 <---

Then if the packet size is larger than this size, the FGT would frangment it unless DF bit is set on the packet.

Toshi

Sign up

Login with SSO

Login to the community

Login with SSO